4 Commits

Include renames

Author	SHA1	Message	Date
sneak	0cf2719ea8	Keep the entrypoint UUID out of webhooker's own logs (closes #531) ... On the receiver route the access log and the per-entrypoint 429 line name the route pattern whatever the status. A request chi never routed, such as a dev-mode CORS preflight to the receiver, logs (unmatched) whatever the status. The received line names the entrypoint and webhook IDs, and the unknown-entrypoint line logs no path. The pattern is middleware.ReceiverRoute, which routes.go registers the receiver with. The README says the proxy's access log holds the UUID and must be protected like the URL, and its access-log, rate-limit, Sentry and log-size passages now match the code. Model: opus-5-5	2026-10-15 10:07:02 +00:00
clawbot	43ed8d4834	Move webhook pages to /hook/ID and inbound URLs to /h/UUID (closes #367) ... The webhook page and everything under it move from /source/ID to /hook/ID; the list and new-webhook form from /sources to /hooks and /hooks/new; the event log from .../logs to /hook/ID/events; entrypoint URLs, the ones senders post to, from /webhook/UUID to /h/UUID. The old paths are simply gone, per the owner's ruling. Every link, redirect, form action, test, comment and README mention follows; every link to the event log, and its title and heading, read "Full Event Log". Keeping the UUID out of logs, metrics labels and error reports, and the receiver rate limits, key on the route itself, so they cover /h/ unchanged. Routed tests follow every link and form the pages render to a moved page. Model: opus-5-5	2026-10-02 06:32:14 +02:00
clawbot	507980a347	Bound username length at creation (closes #184) ... Usernames are limited to 1024 bytes, so no account can exist that is unable to log in. The username rides in the session cookie, which browsers and securecookie refuse past about 4 KB, leaving room for roughly 2000 bytes of username; the limit is about half that. User.BeforeSave returns ErrUsernameTooLong when a whole User is created or saved. A byte-counting check constraint on users.username catches every other write, including a column update. The limit appears in the constant and in the struct tag; a test fails if they disagree. Model: opus-5-5	2026-10-01 21:38:48 +02:00
clawbot	563e834cf2	Bound every slog line against client-chosen text (closes #176)	2026-08-18 06:03:10 +02:00